53 lines
1.4 KiB
Diff
53 lines
1.4 KiB
Diff
From fbb7fa9a9ad8269834d32ff872b1477ff7b9c705 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Wed, 19 Aug 2020 13:13:20 +0200
|
|
Subject: [PATCH 131/139] Fix memory leak in xmlXIncludeAddNode error paths
|
|
|
|
Found by OSS-Fuzz.
|
|
---
|
|
xinclude.c | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/xinclude.c b/xinclude.c
|
|
index 9024535..aac30d5 100644
|
|
--- a/xinclude.c
|
|
+++ b/xinclude.c
|
|
@@ -627,8 +627,8 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
|
|
xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
|
|
"detected a local recursion with no xpointer in %s\n",
|
|
URL);
|
|
- if (fragment != NULL)
|
|
- xmlFree(fragment);
|
|
+ xmlFree(URL);
|
|
+ xmlFree(fragment);
|
|
return(-1);
|
|
}
|
|
|
|
@@ -640,12 +640,15 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
|
|
if (xmlStrEqual(URL, ctxt->urlTab[i])) {
|
|
xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
|
|
"detected a recursion in %s\n", URL);
|
|
+ xmlFree(URL);
|
|
+ xmlFree(fragment);
|
|
return(-1);
|
|
}
|
|
}
|
|
}
|
|
|
|
ref = xmlXIncludeNewRef(ctxt, URL, cur);
|
|
+ xmlFree(URL);
|
|
if (ref == NULL) {
|
|
return(-1);
|
|
}
|
|
@@ -653,7 +656,6 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
|
|
ref->doc = NULL;
|
|
ref->xml = xml;
|
|
ref->count = 1;
|
|
- xmlFree(URL);
|
|
return(0);
|
|
}
|
|
|
|
--
|
|
1.8.3.1
|
|
|